Mastodawn

Эпические баги: как один Break положил телефонную сеть по всему США в 1990 г

В подразделении, где я работаю, есть традиция - новичку при онбординге вручается ссылка на Wiki с легендарными багами, приведшими к заметным последствиям. Недавно мне пришла в голову идея сделать такую же страницу, но уже со ссылками на Хабр, потому что на русском о багах пишут с бОльшим огоньком. Но, увы, оказалось, что каскадному падению серверов AT&T 15 января 1990 года внимание как-то не уделено. А ведь история получилась, прямо-таки эпическая. Итак, 15 января 1990 года из-за одной строчки кода телефонная сеть AT&T получила 9 часов даунтайма, 70 миллионов несовершенных звонков, а общий убыток насчитали в $60 миллионов еще не инфляционных долларов. И нет, там не было неудачного релиза, развернутого сразу и везде. Все было гораздо интереснее.

https://habr.com/ru/companies/beget/articles/1009300/

#4ESS #SS7 #эпический_баг #ошибка #каскадный_сбой #телекоммуникации #тестирование #1990 #надёжность

Эпические баги: как один Break положил телефонную сеть по всему США в 1990 г

Хабр

Show thread

Kevin Karhan

Mar 10

@lackthereof no, it's not because unlike #Phones and #PhoneNumbers, #eMail is not necessarily traceable by circumstances.

Because a Phone "Line" (regardless of whether it's POTS, ISDN, VoIP, GSM, VoLTE, …) and #telephony in general are designed for realtime communication, they inherently necessitate an active, ongoing connection.
- Even if it's just some App/PBX/… to connect to the provider and constantly state "I am on the network and able to recieve calls!" (with PSTN networks, there a physical line that gets assumed to have a phone connected)…

Whereas with eMail (and any #asynchronous #communication) you don't have that requirement.

So unless the provider is being taken over or otherwise "cooperative" there's no means for a sender to know where, when and how a message was retrieved unless the recipient wants the sender to know of it!
- Besides, even if you don't have an eMail provider like cock.li which natively supports @torproject / #Tor useage with an #OnionService, unless said provider explicitly prevents you from doing so, you can use not just Tor but also other techniques to make it extremely hard (not necessarily impossible, but at least unfeasible at scale!) to get tracked down.
- In fact, you could even use #Sneakernet - Style distribution through "#MeatProxies" and #DeadDrops (aka. #dr0p) to further twart tracing attempts.

Or to put it simple:

You can ring up someone and thus circumstantially verify the chain of #PhoneNumber -> #IMSI -> #ICCID -> #SIM -> #IMEI -> Device -> Location -> Owner quite quickly.
- Whereas you can't positively verify whether an eMail address and/or #XMPP+#OMEMO account belongs to me unless I want you to know that it does!

So either way a phone number is just a horrible means of doing that.

And don't even get me started on the fact that legally speaking noone truly owns their number.
- Because even if you got some spechal case number (like UPT was) you still depend on neither regulators nor telcos to not block or otherwise interfere with it. Which is in contrast to say an OnionService which can only be shutdown effectively by sabotage aka. (more or less figurately) "unplugging" it.

I mean, it's not as if I didn't gave @signalapp a fair chance.

I wanted #Signal to be good - honestly...
- But I'm old enough that things rarely are that simple as #TechPopulism & #Propaganda claim it to be.
- Just like 5th grade #SexEd is not a substitute for Endocrinology, Gynecology and Andrology and actually licensed, medical professionals.

So any #Messenger service that requires a #Phone Number for signup and/or useage is truly not a real replacement and inherently makes PROVEN WRONG assumptions [i.e. that it is legal and possible to obtain a phone number anonymously at someone's juristiction] about it's customers' ability to shield their privacy…

Cuz all the "#Metadata" claims of Signal are complete #MarketingLies by virtue of them storing a Phone Number and not just being (as per admission by @Mer__edith) 'hard locked-in' with #aws but also subject to #CloudAct.
They certainly are not deploying real #E2EE cuz you neither get #SelfCustody nor #SelfHosting and have to blindly trust them (aka. "#TrustMeBro!") that what they release as #SourceCode is actually what they deploy.
- It's like all those "#VPN" shillings which one cannot verify to be true or false!

THIS is why I am going fucking ballistic on #TechPopulism aiming at #TechIlliterates because it's spreading a "false sense of #security" whilst completely disregarding absolute fundamentals when it comes to the underlying systems.

And I don't mean shit like #Govware of the #SS7 kind, but absolute basics in #ITsec, #InfoSec, #OpSec & #ComSec that every @cryptoparty / @cryptoparty / #CryptoParty worth it's name touches on.
- Signal can't and won't save peoples' asses and the sooner we realize that "complex problems are hard to fix" the less we waste Resources on #HoneyPots that stench like #CrytpoAG & #ANØM!

ProtonMail Sends User IP and Device Info to Swiss Authorities.

YouTube

Harry Sintonen Jan 20

Someone just attempted to activate #Signalapp on my phone number (I received the SMS verification code all the sudden). Even if they would have some #SS7 hack going on where they can get a duplicate of the SMS, I actually do have a registration lock enabled. (*)

However, it could also be someone making a mistake entering their phone number during setup.

*) https://support.signal.org/hc/en-us/articles/360007059792-Signal-PIN

Signal PIN

Your Signal PIN is a numeric or alphanumeric code used to help you recover your profile, settings, contacts, and block list if you ever lose or switch devices. It supports features like non-phone n...

Signal Support

C.Jan 6

The year is 2027. Email is #unreliable; little gets past #Gmail filters without a contract to receive your #email. #Governments don't stop it because (a) they have a contract, and (b) they don't understand how email works. Or worked.

#Tech companies finally realize that #SS7 is #insecure. Phone calls and texts can't be #trusted. Machine-learning-generated ("AI") audio and video means video and voice calls are doubly cursed - too many #FAANG executives have had embarrassing public #failures, falling #victim to the corporate equivalent of the grandparent #scam.

Few people use #TOTP, because the tech #companies don't promote it, they each call it something else and make it work differently, and they all want you to use their "app" rather than the standard 3-line script that can generate the correct code given a key and the current timestamp. The technically-minded try to educate their relatives and friends as part of the free-tech-support assumption, but no one cares.

#Account #recovery now involves waiting at home to sign for an envelope delivered by the lowest-cost (and therefore bribe-able) courier to the #registered home address of the account. Millions each year lose their email, #photos, videos, "purchased" digital #content, password vaults, etc because they've moved since they set up the account, or they have a P.O. box and companies don't believe those #exist.

The #internet is a vast digital #wasteland - wait, a saviour onstage: "Walled Garden-Net!".

Burn it.

Habr Dec 31

[Перевод] Хороший, Плохой, Расширенный: SS7 атака с использованием расширенных тэгов

Есть два типа операций в SS7, друг мой: безобидные... и те, что держат револьвер... ... Это, конечно, утрирование. Однако, как и герои спагетти-вестернов, операции в SS7 предстают перед нами в полном своем разнообразии и глубине, и иногда их сложно распарсить, а главное - обработать безопасно для абонента. Неверная обработка операций (команд) в SS7 (они же PDUs), несет за собой серьезные риски и потенциально может привести к угрозам уровня уязвимостей нулевого дня, открывая широкий спектр возможных атак.

https://habr.com/ru/articles/982196/

#ss7 #asn1 #сетевые_атаки #tcap #сигнальные_протоколы

Хороший, Плохой, Расширенный: SS7 атака с использованием расширенных тэгов

Хабр

Show thread

🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉Dec 22

Privacy Cell warnt vor unsicheren 2G/3G-Netzen (SS7-anfällig) & IMSI-Catchern – checkt deine Mobilfunkprotokolle für mehr Sicherheit! 📱🔍 Open-Source-App auf F-Droid. https://f-droid.org/en/packages/com.stoutner.privacycell/ #Privacy #FOSS #Datenschutz #SS7
#MeeMeep xD

Privacy Cell | F-Droid - Free and Open Source Android App Repository

Verify that a phone is using the most secure cell protocols.

🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉Dec 22

🔍 frontal enthüllt: First WAP-Software trackt Smartphones weltweit heimlich via #SS7 Lücke – Red Bull-Chefs, Vatikan-Journalisten & mehr betroffen! Dubiose Deals auf Überwachungsmessen. Schockierende Recherche! 📱🕵️‍♂️ https://www.youtube.com/watch?v=zcnw-RGcoP4 #TelefonÜberwachung #Datenskandal #Privatsphäre #Investigativ #LighthouseReports #FirstWAP #ZDF

https://yewtu.be/watch?v=zcnw-RGcoP4

Heimlich überwacht? Dein Handy als Spion | frontal

YouTube

Erik van Straten Nov 14

Zwakke 2FA/MFA werkt AVERECHTS

In https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912477 schreef ik eerder deze week:
❝
2FA (MFA) is ruk.

Laat de overheid een wachtwoordmanager adviseren die wél op domeinnamen checkt.
❞
(Dat laatste kan standaard onder Android, iOS en iPadOS - middels "AutoFill").

Op veler "verzoek" onderbouwde ik die stelling (niet voor de eerste keer) in https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912530.

En in https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912733 legde ik uit waarom online inloggen *lastig* veilig te krijgen is - wat je ook verzint (het blijven shared secrets).

Vandaag heb ik Microsoft Authenticator ook maar weer eens getest (onder Android). Mijn bevindingen leest u in (de tweede helft van) https://www.security.nl/posting/912441/65-plussers+gebruiken+tweestapsverificatie+minder+vaak+dan+gemiddeld#posting912864 - hieronder een stukje daaruit.

#ZwakkeMFA #SMS #AuthenticatorApps #Zwakke2FA #Weak2FA #WeakMFA #MicrosoftAuthenticator #2FAsucks #MFAsucks #Phishing #NepWebsites #PhaaS #Evilginx2 #SIMswap #SS7 #AcountTakeOver #CookieTheft #AccountLockout

Show thread

a1 Oct 30

@HonkHase This is why most carriers have since quite a while implemented #SS7 firewalls. German mobile carriers certainly have this since years. Anyways, a good way of opening the focus wide on the surveillance other than #chatcontrol. Also a good point in time to remember that since 2013 (Ed Snowdens releases) more than a decade has passed, and so has technology.